The bipartisan group of 27 states and the District of Columbia alleges that 23andMe has collected and is now looking to sell “genotype data,” or raw genetic code, from 15 million people that is paired with data on a person’s physical appearance and their family tree. The news comes as the potential buyer, biotechnology company Regeneron, faces a bidding war with 23andMe founder Anne Wojcicki, who offered $305 million for the company through her recently founded nonprofit TTAM Research Institute.

Genetic data is highly personal, the states claim, and its sale could have ramifications for people related to a 23andMe customer or their descendants.

“Virtually all of this personal information is immutable. If stolen or misused, it cannot be changed or replaced,” the lawsuit reads. “Furthermore, this data is exclusively personal and unique, representing that customer’s identity and no other human being.” 

Regeron has said it promises to follow 23andMe’s privacy policies and applicable law, but the lawsuit argues that genetic data—unlike other forms of data routinely sold between companies—could remain in existence in a company database forever and could be used in everything from research to cloning long after future generations of the original 23andMe customer have died.

Importantly, the states allege that selling 23andMe’s genetic data conflicts with privacy protection laws in their individual states. Florida, for example, bars the sale of genetic data without express customer consent under the threat of prison time and up to a $10,000 fine.

In a statement, a spokesperson for 23andMe claimed the argument by the attorneys general were without merit.

“The sale is permitted under 23andMe privacy policies and applicable law. We required any bidder to adopt our policies and comply with applicable law as a condition to participating in our sales process. Customers will continue to have the same rights and protections in the hands of the winning bidder. Both remaining bidders are U.S. companies, have committed to abide by 23andMe privacy policies, and will continue to operate 23andMe as it has always been operated,” the spokesperson wrote.

Daniel Gielchinsky, a Florida-based bankruptcy attorney at DGIM Law not involved in the case, told Fortune that despite the states’ lawsuit, the decision on whether 23andMe can sell its genetic material will be made in bankruptcy court, which has full jurisdiction over the issue. The lawsuit may have been made outside of bankruptcy court because the states believe they won’t get a fair shake for similar objections already raised in bankruptcy court, which has a reputation for being pro-debtor and mostly looking to facilitate either a sale or reorganization.

Furthermore, if the states succeed in preventing the sale of 23andMe’s genetic data, it would render the company essentially worthless, said Gielchinsky. If the bankruptcy court does approve the sale it will likely come with consumer privacy protections that the buyer, Regeneron, must adhere to. 

Still, if the sale of the genetic data is allowed to go forward, it could set a precedent for future cases, as companies collect increasingly personal data about Americans, Gielchinsky said.

“I wouldn’t say it’s as saleable as browsing data, for instance, but certainly this would create a marketplace where that data, that medical data, or biogenetic data, can ultimately be sold to someone who the consumer didn’t sign up with in the first place,” Gielchinsky told Fortune.